Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

Bundled certificate stores draw eMudhra scrutiny beyond nmap and TeX Live

1 source · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

oss-security replies widen the eMudhra bundled-certificate issue to Rust crates, Alpine edge packages, and more NixOS applications.

Two oss-security replies expand an already raised eMudhra certificate problem in bundled certificate stores, previously noted for nmap/ncat and texlive-infra. LN Liberda says some Rust codebases embed a store through the webpki-root-certs and webpki-roots crates, naming uv unless SSL_CERT_FILE or SSL_CERT_DIR is set and Deno unless DENO_TLS_CA_STORE=system is set. An SBOM check of Alpine Linux edge found 29 community and 41 testing packages potentially affected, not confirmed vulnerable. Hanno Böck says many more applications ship affected stores compiled into binaries and cites NixOS nixpkgs issues 576475 and 576541 through 576544. Neither reply describes a fix or exploitation.

Key facts
  • Crates named: webpki-root-certs and webpki-roots.
  • uv uses the bundled store unless SSL_CERT_FILE or SSL_CERT_DIR is set.
  • Deno uses it unless DENO_TLS_CA_STORE=system is set.
  • Alpine edge SBOM: 29 community and 41 testing packages potentially affected.
  • Böck cites NixOS nixpkgs issues 576475 and 576541 through 576544.
  • nmap/ncat and texlive-infra were already in scope; no fix or exploitation is described.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Liberda names Rust crates, uv, Deno, and Alpine counts. · oss-security
  2. Oct 21, 2026Böck cites five NixOS nixpkgs issues for bundled stores. · oss-security

What each outlet adds

beyond the shared facts
  • oss-securityLiberda details Rust crates, uv and Deno overrides, and Alpine counts.
  • oss-securityBöck lists NixOS issues and says stores are compiled into binaries.
Vendors
Alpine LinuxNmapNixOS
Products
uvDenowebpki-rootswebpki-root-certsncattexlive-infranixpkgs
Organizations
eMudhra

Coverage

oldest first · one row per article · UTC
  1. · 9d ago oss-securityFirst report

    uv, Deno and Alpine packages bundle webpki root certificates

    An Alpine edge SBOM check found 29 community and 41 testing packages potentially affected.

  2. · 9d ago oss-security

    More apps bundle cert stores tied to the eMudhra certificate issue

    Hanno Böck points to several NixOS nixpkgs reports beyond nmap/ncat and texlive-infra.